* @return HTML-encoded text fragment
*/
static function encodeAttribute( $text ) {
- $encValue = htmlspecialchars( $text );
+ $encValue = htmlspecialchars( $text, ENT_QUOTES );
// Whitespace is normalized during attribute decoding,
// so if we've been passed non-spaces we must encode them
$id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
$id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
-
+
if( ~$flags & Sanitizer::INITIAL_NONLETTER
&& !preg_match( '/[a-zA-Z]/', $id[0] ) ) {
// Initial character must be a letter!